Splunk initial indexing not behaving as expected

[Branden]

I'm setting up a fresh new Splunk server and am re-indexing my data from scratch.

Syslog data is being sent to my syslog-ng server/Splunk indexer via UDP 514. Rather than being sent directly to Splunk, I have the syslog data distributed to a file system/directory structure that I instruct Splunk to "monitor". (i.e. /logs/hostname/year/month/year/day/logfile)

My expectation was that the host name would be set to the hostname set in the path of the file directory structure, and that everything coming in from the syslog would be set to sourcetype "syslog". Accordingly, here is my inputs.conf:

 [monitor:///logs]
 disabled=false
 sourcetype=syslog
 host_segment=2
 blacklist=\.(bz2|gz)$

And 95% of my events are indexed correctly.

Unfortunately, a few of my events aren't setting the host name correctly; it's using the non-FQDN as indicated in the syslog event itself for some older events (legacy reasons) rather than the name specified in the /logs/hostname segment.

Also, most events are set to "syslog" as instructed in inputs.conf except for dhcp events which are being set to sourcetype "dhcpd". While technically accurate, it's not what I instructed Splunk to do in inputs.conf. I would have expected everything coming in from the /logs monitor to be set to sourcetype="syslog".

Is there a reason Splunk is over-riding my settings?

Thanks!

[woodcock]

A different configuration (inputs.conf) is looking at the same files but with a more specific path/file declaration. Try using btool to list out all inputs.conf settings.